CVE-2021-30774

A Static Dataflow Analysis Framework for iOS Applications.

AegiScan Aegi(s)Scan(er) is a static dataflow analysis framework for iOS application binaries, which can be used to facilitate vulnerability scanning Overview Design AegiScan utilizes top-down type propagation to resolve Objective-C MsgSend calls, thereby reconstructing the call graph It then generates the Code Property Graph (CPG) for each function to establish context-sensi

iService: Detecting and Evaluating the Impact of Confused Deputy Problem in AppleOS (ACSAC'22)

iService Overview iService is a static analysis framework to detect confused deputies in system services in AppleOS Specifically, It resolves Objective-C Messages using the top-down type propagation and performs data dependence analysis to identify input validations of sensitive operations iService discovered 11 confused deputies, of which 5 were 0-day bugs with CVE numbers a